Apache Log4j’s JsonTemplateLayout, in versions up to 2.25.3, serializes non‑finite floating‑point values such as NaN, Infinity, or –Infinity into JSON. Because those values are prohibited by RFC 8259, the resulting output is malformed. This is an instance of CWE‑116—improper encoding or escaping of data, leading to invalid output. The malformed JSON can cause downstream log‑processing or indexing systems to reject or fail to ingest the affected log entries, effectively corrupting audit trails.

Affected are Apache Log4j JSON Template Layout versions up through 2.25.3. The advisory recommends updating to 2.25.4 or newer to address the serialization flaw. Older releases—including the 3.0.0 alpha and beta lines—also use the same layout code and are impacted.

The CVSS score of 6.3 classifies this as a medium‑severity issue, and an EPSS of less than 1 % combined with its absence from the CISA KEV catalog indicates a low likelihood of active exploitation. An attacker must satisfy two conditions: the application must use JsonTemplateLayout and the attacker must be able to force the application to log a MapMessage or an object containing an attacker‑controlled non‑finite floating‑point value. When these prerequisites are met, the corrupt JSON may lead to downstream log‑processing failures, thereby impacting integrity and availability of audit trails.